Lost in the Fog: A New Ransomware Threat

Description

Arctic Wolf Labs began monitoring the deployment of a new ransomware variant called Fog in early May 2024. The ransomware attacks targeted organizations in the education and recreation sectors within the United States. Evidence suggests threat actors gained initial access through compromised VPN credentials and leveraged techniques like credential dumping, lateral movement tools like PsExec, and ransomware payloads with capabilities to disable defenses, encrypt data, and delete backups. The actors appeared financially motivated, seeking rapid encryption and ransom payment rather than data exfiltration.